Security readout for executives and security teams
This CVE describes a local USB-based attack against BMW HU_NBT infotainment head units in several BMW vehicle series produced from 2012 through 2018. The public record does not provide CVSS, CWE, patch, or confirmed exploitation details. Exposure is likely limited to vehicles with the HU_NBT infotainment component in the named BMW series and production years. Fleet owners, used-vehicle programs, dealerships, and service operations have the clearest operational exposure because they manage physical access and maintenance workflows. Prioritize managed fleets and service operations where many vehicles encounter removable media. The issue is less urgent than a remotely exploitable fleet-wide bug, but it matters where physical access is common and vehicle software maintenance is inconsistent. Mitigation focus: Check BMW service guidance for HU_NBT software updates, campaigns, or recalls.; Inventory affected vehicle models, production years, and infotainment head-unit variants.; Restrict unsupervised USB access in fleet, dealership, and service environments..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-9312 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdfCVE reference · x_refsource_MISC
- https://www.theregister.co.uk/2018/05/23/bmw_security_bugs/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.